The Exploit Intelligence
Platform
Aggregating, correlating, and enriching vulnerability and exploit data from 14+ sources into a unified intelligence layer for security professionals and AI agents.
What is EIP?
Software has bugs. Some bugs are security vulnerabilities. Some vulnerabilities have public exploit code. EIP tracks all of it - every known vulnerability, every public exploit, every signal that tells you what matters.
Vulnerabilities
CVEs - unique identifiers for security flaws in software. EIP ingests them from NVD, CVE.org, and 12 other sources to build the most complete picture available.
Exploits
Proof-of-concept code that demonstrates how to trigger a vulnerability. EIP collects exploits from Metasploit, ExploitDB, GitHub, and more - then ranks them by reliability.
Intelligence
Raw data is not enough. EIP correlates exploits to CVEs, flags active exploitation, scores risk with EPSS, and uses AI to classify every exploit for attack type and reliability.
How It Works
A continuous data pipeline ingests from 14 sources, normalizes everything into PostgreSQL, enriches with AI analysis, and serves it through a web UI, REST API, and MCP server for AI assistants.
Ingest
14 data sources crawled 4x daily via 22-step pipeline
Normalize
Match exploits to CVEs, deduplicate, rank by quality
Enrich
AI title generation, exploit analysis, trojan detection
Store
PostgreSQL 16 with materialized views and full-text search
Serve
Web UI, REST API, MCP server, CLI tool, RSS feeds
From raw CVE data to actionable intelligence, no human intervention.
The Numbers
A real-time snapshot of everything the platform tracks - updated four times daily via a 22-step automated pipeline.
Too Many CVEs, Too Little Context
Security teams are drowning in vulnerability data. The real skill is knowing which vulnerabilities actually matter - and that requires correlating data from dozens of fragmented sources.
The Problem
- 40,000+ new CVEs published per year
- NVD alone gives you severity - not exploitability
- Exploit code is scattered across GitHub, ExploitDB, Metasploit, and research blogs
- No single source tells you if a CVE is being exploited in the wild
- Triaging manually takes expert-level skill and hours of research per CVE
The EIP Solution
- Aggregate 14+ sources into one normalized database
- Automatically match exploits to their CVEs
- Flag active exploitation from CISA KEV, VulnCheck, InTheWild, and EUVD
- Score every CVE with EPSS exploitation probability
- AI-classify every exploit for attack type, complexity, and reliability
The Ingestion Pipeline
A 22-step orchestration script runs 4x daily via systemd. It pulls from 7 git repos, 8 APIs, generates AI titles, analyzes exploits, discovers Docker labs, and syncs everything to production.
National Vulnerability Database
The foundational dataset - NIST's comprehensive catalog of every CVE with severity scores, affected products, and references. EIP parses the NVD API 2.0 JSON format from a local git clone.
CISA Known Exploited Vulnerabilities
The US government's authoritative list of CVEs confirmed to be actively exploited in the wild. If it is on the KEV list, someone is using it to break into real systems right now.
EPSS - Exploit Prediction Scoring
A machine learning model from FIRST.org that predicts the probability of a CVE being exploited in the next 30 days. Unlike CVSS (severity), EPSS measures actual exploitability.
ExploitDB
The oldest and most curated public exploit archive. Run by OffSec, every entry is reviewed before publication. EIP parses the full CSV catalog and source code from a local git clone.
GitHub PoC Search
Two crawlers search GitHub for proof-of-concept exploit repositories - the Search API for individual repos and a monorepo scanner that discovers multi-CVE collections via the Git Tree API.
NomiSec PoC Index
The nomi-sec/PoC-in-GitHub project maintains a curated, continuously-updated JSON index of GitHub repositories containing CVE proof-of-concept exploits - one of EIP's largest exploit sources.
Metasploit Framework
The world's most widely used penetration testing framework. Metasploit modules represent the highest quality exploit code - peer-reviewed, reliability-ranked, and weaponized for real engagements.
Nuclei Templates
ProjectDiscovery's community-driven vulnerability scanner templates. Each template is a YAML-based detection signature that can verify if a target is vulnerable - without exploitation.
InTheWild
Two complementary feeds from InTheWild.io - an exploitation signal API that confirms which CVEs are being exploited in the wild, and a repo tracker that discovers GitHub PoC repositories from a community-maintained SQLite database.
VulnCheck KEV
A commercial-grade exploitation catalog that goes beyond CISA KEV with ransomware campaign attribution, earliest exploitation dates, and cross-database exploit repository tracking.
GitHub Security Advisories
GitHub's advisory database provides package-level vulnerability data across 8 software ecosystems. EIP uses it to enrich CVEs with the specific library versions affected - critical for developers triaging supply chain risk.
OSV - Open Source Vulnerabilities
Google's OSV database provides structured vulnerability data for open-source ecosystems. EIP currently ingests the Linux ecosystem for kernel vulnerability tracking with precise version range data.
CVEList - CVE.org CNA Records
CVE.org publishes CVE records from CNAs (CVE Numbering Authorities) before NVD processes them. EIP ingests these early records to get vulnerability data hours or days ahead of NVD enrichment.
CWE Catalog - MITRE
MITRE's Common Weakness Enumeration taxonomy classifies vulnerability types - buffer overflows, SQL injection, XSS, and hundreds more. EIP uses CWE data for categorization, title generation, and the CWE browser.
EUVD, PatchaPalooza, and GitLab
Three additional sources round out EIP's coverage - the EU's vulnerability database for European exploitation signals, PatchaPalooza's curated PoC index, and GitLab search for non-GitHub exploit repos.
EUVD
Paginates ENISA's EU Vulnerability Database search API for exploited entries. Maps EUVD IDs to CVEs via aliases. Sets is_euvd_exploited flag. 6-second delay between pages for rate compliance.
PatchaPalooza
Fetches curated PoC repos from patchapalooza.com/api/exploits. Converts SSH clone URLs to HTTPS for GitHub, Gitee, and GitLab. Cross-source deduplication prevents repo double-counting.
GitLab Search
Searches GitLab's API for PoC repositories, extending coverage beyond GitHub. Uses the same quality filtering and CVE matching pipeline. Requires GITLAB_TOKEN.
Every public exploit, every known vulnerability, one platform.
The Correlation Engine
Raw data from 14 sources is meaningless without correlation. EIP matches every exploit to its CVE, ranks them by quality, and builds a unified intelligence picture for each vulnerability.
Exploit Matching
- CVE references extracted from exploit metadata, code comments, and file names
- Multi-CVE modules (Metasploit) create separate entries per CVE
- Pre-CVE stubs created for exploits without CVE matches (EIP-ID sequence)
- Cross-source deduplication prevents the same repo appearing from NomiSec, GitHub Search, and InTheWild
Exploit Ranking
- Tier 1: Metasploit modules (weaponized, peer-reviewed)
- Tier 2: Verified ExploitDB entries (curated by OffSec)
- Tier 3: GitHub PoCs ranked by stars, forks, and language
- Flagged: Trojans and backdoored exploits pushed to bottom with warnings
AI Title Generation
339,493 of 339,495 CVEs have AI-generated titles - 99.99% coverage. A rule engine handles the common cases, and Ollama LLM handles the rest. Basis hashing detects when upstream data changes and titles need regeneration.
LLM Exploit Analysis
Every exploit gets analyzed by devstral-2 with 5 parallel workers. The AI classifies attack type, complexity, reliability, maps MITRE ATT&CK techniques, and detects trojans with deception indicators and IOCs.
Classification
working_poc, trojan, suspicious, scanner, stub, or writeup - determines what the code actually does
Attack Type
RCE, SQLi, XSS, DoS, LPE, auth_bypass, info_leak - what the exploit targets
Complexity
trivial, simple, moderate, complex - how much effort to use it
Reliability
reliable, unreliable, untested, theoretical - will it actually work
MITRE ATT&CK
Mapped techniques per exploit for threat modeling and detection engineering
Trojan Detection
Deception indicators, IOCs, backdoor mechanics, operator risk assessment, evidence snippets
The REST API
A FastAPI backend serving 21 endpoints with full-text search, 18 filter parameters, rate limiting via Valkey, and GZip compression. CORS-restricted to exploit-intel.com.
Vulnerability Search
GET /api/v1/vulns
Full-text search with 18 filters: severity, KEV, exploited, ransomware, has_exploits, has_nuclei, vendor, product, ecosystem, CWE, CVSS, EPSS, date ranges, sorting
CVE Detail
GET /api/v1/vulns/{cve_id}
Full intelligence brief: CVSS, EPSS, KEV status, ranked exploits with LLM analysis, affected products, Nuclei templates, references, alt IDs
Exploit Code
GET /api/v1/exploits/{id}/code
Source code viewer with path traversal prevention. Reads from tar.gz archives, directories, or single files. Password-protected ZIP download
Browse & Filter
GET /api/v1/exploits
Browse exploits by source, language, classification, attack type, complexity, reliability, author, stars, CVE, vendor, product
Statistics
GET /api/v1/stats/trends
13 time-series datasets: CVE volume, CWE breakdown, exploitation trends, EPSS calibration, time-to-exploit, KEV lag, Nuclei coverage
Authors & CWEs
GET /api/v1/authors, /cwe, /vendors
Researcher profiles, CWE categories with exploit likelihood, vendor rankings - all with pagination and search
exploit-intel.com
The public face of the platform - vulnerability search, exploit code viewer, statistics dashboards, labs, and comprehensive API documentation. Built with Jinja2 templates and 7 color themes.
CVE-2026-2203 - Fortinet FortiOS
CVE-2025-9811 - Palo Alto PAN-OS
Statistics Dashboard
13 interactive ECharts visualizations powered by materialized views. Live at exploit-intel.com/stats
MCP Server - 17 Tools
A Model Context Protocol server that gives AI assistants direct access to the entire EIP database. Search vulnerabilities, analyze exploits, audit technology stacks, and generate pentest findings - all from natural language.
search_vulnerabilities
Full-text CVE search with structured filters
get_vulnerability
Full intelligence brief for a specific CVE
get_exploit_code
Read exploit source code (50KB cap)
get_exploit_analysis
AI analysis: type, complexity, MITRE, trojans
audit_stack
Audit up to 5 technologies for exploitable vulns
generate_finding
Pentest report finding in Markdown
search_exploits
Browse exploits with structured filters
get_nuclei_templates
Detection templates + Shodan/FOFA dorks
+ 9 more tools
Authors, CWEs, vendors, products, stats, health, alt-ID lookup
MCP Prompt Workflows
Six pre-built prompt workflows guide AI assistants through multi-step vulnerability research. Each workflow chains multiple MCP tools together for comprehensive analysis without manual orchestration.
investigate-cve
Deep-dive: get_vulnerability, analyze each exploit, read best code, fetch Nuclei templates
audit-stack
Technology stack audit with prioritized remediation report sorted by EPSS probability
pentest-finding
Professional pentest finding with enhanced remediation guidance in Markdown
threat-landscape
Vendor/product threat analysis with KEV, ransomware, and exploited-in-wild context
exploit-analysis
Safety-first exploit analysis with trojan detection before code review
trending-threats
Trending threats briefing with configurable time window and focus area
MCP Server in Action
Real terminal recordings showing the MCP server connected to Claude Code - from setup to vulnerability research.
Docker Labs Pipeline
Automated discovery and verification of Docker-based exploit labs from 53K+ GitHub PoC repos. Every lab is scanned for safety, enriched with CVE metadata, and served through the web UI.
Discovery Pipeline
- Harvest Docker images from 53K+ GitHub exploit repos
- LLM safety scan to filter malicious lab environments
- Build community_labs.json with 2,289 community labs
- Generate labs.json from GHCR (63 EIP-verified labs)
- Smart infra filtering - exclude base images and build tools
Web Integration
- Labs page at /labs with EIP + community tabs
- Each lab enriched with CVE title from the database
- Docker pull commands and setup instructions
- Linked from vulnerability detail pages
- Rsynced to app servers after each pipeline run
Infrastructure
Production-grade deployment with redundant app servers, managed database, shared cache, and a dedicated ingest host - all behind a load balancer and Cloudflare CDN.
Platform Features
Beyond search - the platform includes SEO landing pages, ecosystem browsers, RSS feeds, XML sitemaps, an AI chat assistant, and a CLI tool for terminal-based vulnerability research.
Focus Pages
6 curated landing pages: critical exploits, exploited with PoC, high EPSS, Nuclei templates, latest exploits, KEV gaps
12 Ecosystems
npm, PyPI, Maven, Go, NuGet, RubyGems, Packagist, Crates.io, Hex, SwiftURL, Linux, GitHub Actions
RSS Feeds
Three feeds: recent CVEs, CVEs with exploits, and new CISA KEV additions - for automated monitoring
Exploit Code Viewer
Syntax-highlighted source code browser with LLM analysis, backdoor review, and author profiles
AI Chat (Beta)
Password-gated AI assistant at /chat for natural language vulnerability research with 30-day sessions
CLI Tool
eip-search - terminal-based vulnerability lookup with formatted output for security researchers
Built Secure by Default
An exploit database is a high-value target. Every layer of EIP is hardened - from XML parsing to exploit code serving, rate limiting to path traversal prevention.
Defense in Depth
- defusedxml for all XML parsing (XXE prevention)
- Path traversal prevention on exploit code endpoints
- SVG intentionally excluded from image serving (XSS risk)
- Exploit code never in server-rendered HTML (Google malware flags)
- CORS restricted to exploit-intel.com, GET+OPTIONS only
Operational Security
- Rate limiting: 60/min per IP via Valkey, IP whitelist support
- Password-protected exploit ZIP downloads
- noindex/nofollow on exploit code paths
- Jinja2 autoescape on all templates (XSS prevention)
- MCP server: null byte rejection, DNS-rebinding protection, 50KB code cap
Results
What the platform delivers - comprehensive vulnerability intelligence that no single source provides alone.
Coverage
- 339,495 CVEs with 99.99% AI-generated titles
- 77,762 exploits from 8 sources, ranked by quality
- 53,335 CVEs matched to at least one public exploit
- 3,948 Nuclei detection templates with recon dorks
- 2,352 Docker labs for hands-on exploitation practice
Intelligence
- 4 independent exploitation signals correlated per CVE
- Ransomware campaign attribution via VulnCheck
- 61K+ exploits analyzed by AI for type, complexity, and reliability
- Trojan detection with deception indicators and IOCs
- MITRE ATT&CK technique mapping for every analyzed exploit
From raw CVE to actionable intelligence, fully automated.
The Exploit Intelligence
Platform
Comprehensive vulnerability and exploit intelligence - aggregated from 14 sources, enriched by AI, and accessible to both humans and machines.